![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 20 months ago
Last modified 14 months ago
#62604 new enhancement
Prevent false-positive in validate_callback() in REST API
| Reported by: | Takahashi_Fumiki | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | REST API | Version: | |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: |
Description (last modified by )
Related: https://github.com/WP-API/docs/issues/194
'type' => 'string', 'validate_callback' => function( $should_be_date ) { return preg_match( '/^\d{4}-\d{2}-\d{2}$/u', $should_be_date ); }
Above validation expects the parameter should be 'YYYY-MM-DD' format, but actually any string as "valid" because preg_match() returns 0(falsy value) for mismatch.
So, validation priority should be is_wp_error() -> "is true?" -> "else, invalid."
Concerns:
strpos() return 0 for match.
Change History (3)
Note:
See TracTickets
for help on using tickets.
Related: https://github.com/WP-API/docs/issues/194
Above validation expects the parameter should be 'YYYY-MM-DD' format, but actually any string as "valid" because
preg_match()returns 0(falsy value) for mismatch.So, validation priority should be
is_wp_error()-> "is true?" -> "else, invalid."Concerns:
strpos()return 0 for match. This result as false-negative in terms of backward-compatibility.https://core.trac.wordpress.org/ticket/62604#ticket
Trac ticket: